CVE-2026-78054: Cross Site Scripting in SourceCodester Class and Exam Timetabling System

SourceCodester Class and Exam Timetabling System 1.0 contains a cross-site scripting vulnerability in an unspecified function of the /BSIS1.php file. An attacker can manipulate the 'course' parameter to inject malicious scripts, which may be executed in the context of a victim's browser. The vulnerability is remotely exploitable without privileges and does not require user authentication, but user interaction is needed to trigger the attack. Exploit code has been publicly disclosed.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the victim's browser, potentially leading to session hijacking, defacement, or redirection to malicious sites. However, the impact is limited by the need for user interaction and the absence of elevated privileges or direct system compromise.

No official patch or remediation is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should apply standard XSS mitigations such as input validation and output encoding on the 'course' parameter if possible.